Emergency control of an aircraft

ABSTRACT

An aircraft emergency control system comprises at least one sensor (104A, 104B, 104C) configured to output an electronic signal relating to detection of incapacitation of at least one aircraft crew member. A processor (108) is configured to receive and process the electronic signal to determine whether emergency action is to be taken. A control unit (114) is configured to communicate, in use, a control signal to an avionics system (116) of the aircraft (100) in relation to the emergency action if the processor determines that emergency action is to be taken.

The present invention relates to control of an aircraft, andparticularly but not exclusively, to emergency control of an aircraft inthe event of crew incapacitation.

In a multi-crew aircraft environment, incapacitation by one of the crewmembers may be obvious to other members immediately, and can becomeprogressively more evident. Alternatively, the incapacitation couldescape notice until there is an unexplained response, or until action istaken by another of the crew members. However, if all pilot(s) of amulti/single crew aircraft become(s) incapacitated then the safety ofthe flight will be severely compromised and loss of control likely.

A subtle incapacitation of one of two pilots could also present asimilar risk, especially at low level and particularly if it occursduring a precision approach in low visibility procedures. Anotherconsideration in the case of total crew incapacitation is loss ofseparation in the airspace, as well as flying into terrain or obstacles.

Previous work in this area has primarily considered the case where therehas been a hijack of an aircraft, e.g. U.S. Pat. No. 7,142,971, whichrelates to a system and method for automatically controlling a path oftravel of a vehicle.

However, this and other solutions do not consider the case of total crewincapacitation, or how the aircraft would safely navigate a safe routeand land.

Embodiments of the present invention are intended to address at leastsome of the above technical problems. Embodiments of the solutiondisclosed herein can provide an Electronic Standby Pilot that willmanage the aircraft functions to allow safe flight and landing in thecase of total crew incapacitation under all weather conditions.

According to one aspect of the present invention there is provided anaircraft emergency control system, the system comprising:

at least one sensor configured to output an electronic signal relatingto detection of incapacitation of at least one aircraft crew member;

a processor configured to receive and process the electronic signal todetermine whether emergency action is to be taken, and

a control unit configured to communicate, in use, a control signal to anavionics system of the aircraft in relation to the emergency action ifthe processor determines that emergency action is to be taken.

The at least one sensor may comprise an imaging device. The processormay be configured to analyse images encoded in the electronic signals ofthe imaging device in order to detect movement of the at least one crewmember, and determine that the emergency action is to be taken if nosaid movement is detected during a predetermined period of time.

The at least one sensor may comprise an audio device. The processor maybe configured to analyse audio data encoded in the electronic signals ofthe audio device, and determine that the emergency action is to be takenif no said audio data indicating speech and/or movement of the at leastone crew member is detected during a predetermined period of time.

The at least one sensor may provide a said electronic signalrepresenting operation of at least one controller of the aircraft by theat least one crew member. The processor may be configured to determinethat the emergency action is to be taken if the electronic signalsindicate that the at least one controller has not been operated over apredetermined period of time.

The control unit may transmit control signals to stabilise the aircraftand/or to perform bad weather avoidance.

The processor may be configured to generate an emergency route forflying the aircraft to an emergency destination airport. The system may,in use, transfer data relating to the emergency route to a FlightManagement System of the aircraft. The system may, in use, use anauto-pilot system of the aircraft to implement the emergency route.

The system may further comprise a communications interface configured toestablish an authenticated communications link with a remote station.The system may, in use, transfer data relating to the emergency route tothe remote station. The system may be operable in:

a first mode wherein the system is able to generate or modify theemergency route without support from the remote station and controls theaircraft to implement the emergency route, and/or the system is able toallow an authenticated onboard crew member to regain manual control ofthe aircraft from the system, or

a second mode wherein input from the remote station is required forgeneration or modification of the emergency route and to allow thesystem to implement the emergency route, and/or input from the remotestation is required to allow an authenticated onboard crew member toregain manual control of the aircraft from the system.

A said emergency route generated by the system and/or the remote stationmay be restricted to follow officially recognised airways and/or followaltitude and speed constraints of the officially recognised airways.

The system may be configured, in use, to load a said emergency routegenerated or modified by the remote station into a Flight ManagementSystem of the aircraft. If the link between the system and the groundstation is active in use then the system may be disabled from modifyingthe loaded emergency route. If the link between the system and theground station is lost in use then the system may be enabled to modifythe loaded emergency route, e.g. following expiry of a safety time-outtimer.

The system (and/or the ground station) may be configured to generate theemergency route by:

generating a plurality of potential emergency routes;

assigning scores to each of the plurality of potential emergency routes,and

selecting one of the plurality of potential emergency routes forimplementation based on the assigned scores.

The step of assigning the scores to the emergency routes may comprise:

applying a demotion or promotion factor to at least one section of asaid route based on at least one factor,

wherein the at least one factor is selected from a set comprising:distance; flying altitude constraints; weather conditions; suitabilityin terms of aircraft fuel levels; collision risk; destination airportfeatures, and/or destination airport runway features.

The method may further include:

generating data representing 3D coordinates of the sections of a saidemergency route;

generating a 3D polygon representing an obstacle and/or weathercondition, and

processing the data representing 3D coordinates of the sections of asaid emergency route and the 3D polygon to compute a said score for theemergency route.

According to another aspect of the present invention there is providedan (computer-implemented) aircraft emergency control method, the methodcomprising:

receiving an electronic signal relating to detection of incapacitationof at least one aircraft crew member;

processing the electronic signal to determine whether emergency actionis to be taken, and

if the processing determines that emergency action is to be taken thencommunicating, in use, a control signal to an avionics system of theaircraft in relation to the emergency action.

If the processing determines that emergency action is to be taken thenthe method may further comprise starting a timer for receiving a userinput to prevent the sending of the control signal to the avionicssystem. A duration of the timer may be related to an altitude of theaircraft.

The method may further comprise transmitting a mayday signal indicatingthat the at least one crew member has been incapacitated. The method maycomprise disabling manual control of the aircraft while the at least onecrew member is determined to be incapacitated. The method may comprisere-enabling manual control of the aircraft upon receipt of controlregain signals from a remote station over an authenticatedcommunications link.

According to a further aspect of the present invention there is providedan aircraft including a system substantially as described herein.

According to a further aspect of the present invention there is provideda station configured to exchange data with a system substantially asdescribed herein.

The station may be configured to store a said emergency route in asecondary data store during emergency route generation and store theemergency route in a primary database when the emergency route isdetermined to be safe for transfer to the aircraft.

According to yet another aspect of the present invention there isprovided an emergency system comprising a system and a stationsubstantially as described herein.

According to another aspect of the present invention there is providedapparatus configured for emergency control of an aircraft, the apparatuscomprising:

at least one receiver for receiving an electronic signal relating todetection of incapacitation of at least one aircraft crew member;

a processor configured to receive and process the electronic signal todetermine whether emergency action is to be taken, and

a control unit configured to communicate, in use, a control signal to anavionics system of the aircraft in relation to the emergency action ifthe processor determines that emergency action is to be taken.

According to yet another aspect of the invention there is provided amethod of (and system configured for) controlling flight and,optionally, safe landing of an aircraft in the event of crewincapacitation, the method comprising at least some of the followingsteps: detection of crew incapacitation through monitoring the crewresponses from two or more independent and functionally differentsensors; engaging automatic control of the vehicle after the crew hasnot responded to an alert after a pre-determined time interval based onthe safe attitude of the vehicle; disabling any manual control of theaircraft while the crew is still determined to be in an incapacitatedstate; initiating a mayday signal that the crew has been incapacitated;controlling safe flight operation and navigation through the airspacevia an incapacitation flight safety manager (the Electronic StandbyPilot), which automatically negotiates the flight plan with the groundsystems, before initiating the controlled landing of the aircraft at apredetermined optimum landing setting and then bringing the aircraft toa halt on the landing surface.

The ESP may establish, via a communication function, a trusted link witha ground system to allow the ground system to have strategic control ofthe aircraft by providing amended flight plans via the ESP that are onthe navigation system, that follow the altitude and speed constraints ofthe airways.

The ESP may be activated by establishing via the communication functiona trusted link with a ground system to receive and check amended flightplans that are on the navigation system, and plans that follow thealtitude and speed constraints of the airways and/or which can provideon board strategic control of the aircraft.

The ESP may be activated and be prevented from establishing a trustedlink with a ground system, and may calculate and activate a new routethat is on the on board navigation system that follows the weather,altitude and speed constraints of the airways and the fuel limitationsof the aircraft.

The ESP may pass control back to the crew if an authenticated crewmember interacts though one of the cockpit or flightdeck systems (e.g.via a non simplex system) to disengage the ESP and regain control of theaircraft. A crew member can be authenticated, for example, by entering asuitable password or using a physical device, such as a key, inconnection with the ESP. If the ESP is operating without support fromthe ground station then this regaining of manual control may be donethrough a menu system, or the like, of the ESP. However, if the ESP isoperating with support from the ground station then the regaining ofcontrol will be a controlled handover, e.g. similar in methodology tohow a pilot transfers controls to the co-pilot or resting pilot.

The ESP may check that the route is within the limits of the navigationdatabase and the current state of the aircraft. The ESP may not overridea trusted ground system loaded link. If the trusted ground systemcommunication link is lost then the ESP will remain in ground systemmode for a ground system link lost timeout period and will establishfull ESP control if that timeout period is exceeded. The ESP maycalculate the optimum route by using at least one of: a navigationdatabase; demotion factors to demote/promote airways; 3-dimensionalpolygons to represent demoted/hazardous airspace, and/or use of aircraftendurance.

The ESP may calculate an optimum destination airport by at least one ofthe following factors: checking for a minimum performance level to allowthe aircraft to land at this runway (e.g. Instrument Landing System(ILS) precision approach, minimum allowed runway length, etc), even ifpreselected; original destination; good support services as an airportrating, and/or pre-down selected preferred airports which can be updatedby a ground station.

The ESP may not change the route loaded in the navigation system unlessits route rating/scoring is suitably better than the existing route byan aircraft-defined percentage factor and/or a fixed value factor, e.g.20% better with at least reduction of route distance/score of 100nautical miles. The ESP may hand over temporary control to collisionavoidance and aircraft recovery systems and regain control when theaircraft has stabilised. Collision avoidance may use FMS commands foraltitude control. A Traffic Collision Avoidance System (TCAS) may beaware of the aircraft's state and negotiation will attempt aircraftavoidance by a preferred altitude level. Aircraft State (ESP activeduration/speed/direction/altitude/GS link state) and intent (route/finaldestination) may be relayed via existing aircraft systems. For example,ADS-B to allow increased separation and awareness from other aircraft,and can also allow other aircraft to cross check with ESP aircraft. Thiscan reduce collision risk and allow other aircraft to report theirintent to ATC and the ground station via voice or data communication inorder to support the ESP if no link to the ground station is present andwarn other close aircraft.

According to yet another aspect there is provided a method of aircraftroute generation comprising:

generating a plurality of potential routes;

assigning scores to each of the plurality of potential routes, and

selecting one of the plurality of potential routes for implementationbased on the assigned scores.

According to yet another aspect of the present invention there isprovided an (method of establishing an) authenticated communicationslink between an aircraft and a remote station substantially as describedherein.

According to another aspect, the present invention provides apparatusincluding a processor configured to operate methods substantially asdescribed herein.

According to further aspects of the present invention there are providedcomputer-readable storage medium including instructions that, whenexecuted on a processor, causes the processor to perform methodssubstantially as described herein.

BRIEF DESCRIPTION OF THE FIGURES

For a better understanding of the invention, and to show how embodimentsof the same may be carried into effect, reference will now be made, byway of example, to the accompanying diagrammatic drawings in which:

FIG. 1 schematically illustrates an aircraft including an embodiment ofthe emergency control system in communication with a ground station;

FIG. 2 is a flowchart illustrating example operation of the emergencycontrol system;

FIG. 3 details a full activation mode of the emergency control system;

FIG. 4 graphically illustrates a route planning operation of theemergency control system, and

FIG. 5 further graphically illustrates a route planning operation of theemergency control system.

DETAILED DESCRIPTION OF THE FIGURES

FIG. 1 schematically shows part of an example aircraft 100. The aircraftwill typically comprise an aeroplane, although other types of mannedaircraft, such as helicopters, are not excluded. The example aircraftincludes a cabin 102, where at least one crew member is normallystationed in order to control and/or oversee fight/operation of theaircraft. In the example aircraft the cabin is typically occupied by twopilots.

Embodiments of the emergency control system can comprise at least onesensor that can provide an electronic signal to an Electronic StandbyPilot (ESP) device 106. The ESP device 106 can comprise a computingdevice that includes a processor 108, memory 110, communicationinterface 112 and a control unit 114. In some cases the device 106 maybe a stand-alone/special purpose computing device, or it may be part ofat least one other component of the aircraft, e.g. partially integratedinto an auto-pilot system of the aircraft. The communications interfacecan exchange data with remote devices over various types of wired orwireless links.

The control unit 114 of the ESP device 106 can be in communication withavionics components 115 of the aircraft 100, such as a Flight ManagementSystem (FMS) 117 and an auto-pilot system 116 (these are non-limitingexamples). The ESP device can transfer control signals to suchcomponents and may also receive data/signals from them. The auto-pilotsystem can control the aircraft's flight control system 118, whichtypically includes components/subsystems such as flaps, 118A, gears1186, brakes 118C, etc. The functioning and construction of aircraftcomponents, such as the auto-pilot and the flight control system, willbe known to the skilled person and need not be described herein indetail. It will also be appreciated that the illustrated positioning andarrangement of components of the emergency control system in relation toother aircraft systems/components are exemplary only and many variationsare possible. In practice, components of the emergency control systemmay be installed in an aircraft (or in aircraft component(s)) duringmanufacture, or may be retro-fitted to existing aircrafts/components.

A first example sensor 104A comprises an imaging device, such as a stillor video camera. A second example sensor 104B comprises an audio device,such as a recording device or microphone. As another example, a sensor104C may be located in (or be in communication with) a controller, e.g.joystick 105 or any other component with which a crew member interacts.This sensor may generate an electronic signal every time the controlleris operated by a crew member. Although the sensors are shown positionedwithin the cabin 102 in the example, it will be understood that thisdoes not necessarily need to be the case. It should also be understoodthat these sensors are merely examples and other types may be providedwith the intention of generating electronic signals that can be used todetect incapacitation of at least one aircraft crew member. In preferredembodiments there are at least two independent and functionallydifferent sensors, which can improve the accuracy of detection and avoidfalse alarms.

The communications interface 112 of the ESP device 106 is shown incommunication with a remote station 113. The remote station willtypically be at a fixed ground location, although variations arepossible, e.g. it could be located on board another aircraft, or a seaor land-based vehicle, or it may be a portable device carried by a user.Its components could also be geographically distributed. The remotestation includes a computing device 120 that includes a processor 122,memory 124 and a communications interface 126. The communicationsinterface is capable of establishing a trusted link 130 forcommunication with the communications interface of the ESP device, andcan also communicate via other communications links with other local orremote devices/data stores (not shown). The ground station system willtypically be operated by an airline pilot, or other person(s) having theexperience required to understand the emergency situation andcommunicate with the ESP device.

In operation, embodiments of the aircraft emergency control system areintended to control the flight and safe landing of the aircraft 100 inthe case of crew incapacitation. If the aircraft is at an unsafeattitude then it can initiate auto-recovery to a safe attitude. The ESPdevice 106 can receive electronic signals from the at least one sensor104A-104C and process these to determine whether at least one crewmember (typically all relevant/crucial crew members, such as thepilot(s) stationed in the cabin 102) has/have been incapacitated forsome reason. The electronic signals can have any suitable format andcontent, and may be transferred via wired or wireless channels using anyappropriate protocol(s), network(s), etc.

FIG. 2 is a flowchart showing an overview of example operation of thesystem. The operations may be at least partially implemented by means ofcode executing on at least one computer device, such as the ESP device106 of FIG. 1. It will be appreciated that the flowcharts/diagrams shownherein are exemplary only and at least some of the illustrated steps maybe re-ordered or omitted. Also, additional steps may be performed.Further, although steps are shown as being performed in sequence, somecould be executed concurrently in alternative embodiments. The steps maybe performed by the same, or different, processors/devices. The skilledperson will also appreciate that the operations described herein can beimplemented using any suitable programming language/means and datastructures.

At step 202, the ESP device 106 is in a standby mode, where normalcontrol of the aircraft 100, e.g. by the pilot(s) and/or auto-pilotsystem 116, is taking place. During this standby mode, the ESP devicecontinuously (or intermittently, or on an event basis, or on-demandbasis) performs determinations as to whether at least one crew member isincapacitated. This determination will be based on processinginformation provided by the at least one sensor 104A-104C. The ESPdevice may only change to a primed mode if signals received from atleast two (functionally different) sensors indicate that incapacitationhas taken place. Weighting or prioritisation may be applied to some ofsensors or certain combinations of sensors/electronic signals.

For instance, with regards to the imaging device sensor 104A, the ESPdevice 106 can analyse images encoded in the electronic signals of theimaging device in order to detect movement of the at least one crewmember, e.g. using known image processing/comparison techniques. Theprocessor of the ESP device may determine that it needs to change fromthe standby mode to a primed mode if no movement is detected, e.g. nosubstantial change in a part of the image recognised as a crew member,over a predetermined period of time and/or over predetermined number ofimage frames. The skilled person will appreciate that the period of timecan vary, e.g. from one minute to several minutes. Also, thepredetermined period of time may change based on various factors; forinstance, it may be shorter when it is expected that a pilot will movemore frequently, e.g. when preparing for a landing operation.

With regards to the audio device/microphone sensor 104B, the ESP device106 may analyse the audio data encoded in the electronic signals, anddetermine that it needs to change from the standby mode to the primedmode if no said audio data indicating speech and/or movement of the atleast one crew member is detected during a predetermined period of time.Again, it will be understood that the details of thisdetermining/processing can vary; for instance, the process may be ableto distinguish speech originating in the cabin as opposed to speechbeing received from elsewhere (e.g. via a radio link); the process maycancel out engine noise or other ambient sounds; it may be triggered (orincreased in sensitivity, and/or reduce the predetermined period oftime) when it is informed that there has been no response to an externalcommunication attempt, etc.

With regards to the controller operation sensor 104C, the ESP device 106may determine that it needs to change from the standby mode to theprimed mode if, for example, it has not receive a signal indicating thatthe controller has been operated over a predetermined period of time.Again, it will be understood that the details of thisdetermining/processing can vary; for instance, it may not be performedif is known that auto-pilot is currently operating, etc.

Typically, the ESP device 106 will process the electronic signalsreceived from the at least one sensor 104 in order to perform thedetermination, although in some embodiments, the sensors may include (orbe in communication with) a processor that performs the determination,and can then transfer an electronic signal indicating incapacitation (ornon-incapacitation) to the ESP device, which performs further processingbased on that received signal.

If the ESP device 106 enters the primed mode (step 204) then it canstart a timer to give crew members an opportunity to prevent it fromentering an initial activation mode. During the primed mode, normaloperation of the aircraft 100 will continue to take place. However, thesystem may emit an internal warning signal (in the cabin 102 and/orelsewhere in the aircraft) in order to alert any available crewmember(s) that incapacitation has been detected, and a timer may bestarted in order to allow any such crew member to prevent an initialactivation mode from being entered. The duration of the timer can rangefrom, say, 30 seconds to several minutes. In some embodiments, theduration of the timer may be based on at least one factor, such as thealtitude of the aircraft (e.g. the higher the altitude, the longer theduration), the velocity of the aircraft, etc.

For safety, the system may include a special type of control to allowthe crew member to prevent the initial activation mode from beingentered, and/or to help avoid standby mode being re-enteredaccidentally. For example, the control may comprise a “break glass toaccess” type protected button/switch; a key-activated switch, orrequiring an appropriate security code to be entered onto a computerterminal. If the prevention action is taken then ESP device 106 canreturn to the standby mode 202. If the prevention action is not takenand the timer reaches the predetermined time-out period then the systementers the initial activation mode. Information regarding mode changesmay be stored by the system and/or transferred to a remote device for(future) analysis. Further, if during any mode, a signal is receivedindicating that the at least one crew member is no longer incapacitated(or has been safely replaced) then the system may re-enter the standbymode.

If the ESP device 106 enters the initial activation mode (step 206) thenit begins the process of controlling flight operation of the aircraft100. It may give any non-incapacitated crew member(s) a predeterminedperiod of time to override it before any strategic action (e.g. routechange) is performed. The ESP device may also offer a (typically short)period of time for a ground station and/or Air Traffic Controller tobecome aware of the situation, e.g. by transmitting warning signals.Other actions that may take place under the control of the ESP device inthis mode include stabilising the aircraft (if required) and/oremergency avoidance of any short term hazards (e.g. traffic, weatherand/or terrain). If no preventative action is taken in time then theemergency control system can enter full activation mode (step 208).

In the full activation mode the ESP device 106 may transmit a maydaysignal indicating that the crew has been incapacitated, e.g. using aradio or other communication unit of the aircraft 100. The system candisable any manual control of the aircraft while the crew is stilldetermined to be in an incapacitated state. Embodiments may also becapable of conducting weather avoidance. Embodiments of the system aimto control the flight operation of the aircraft and land at an airport.The selected airport can be negotiated with the ground station system113 and a revised flight plan may be implemented. The ESP device mayalso bring the aircraft to a halt on the runway after landing.Instrument Landing System and/or visual cues from sensors on theaircraft may be used to maintain the aircraft on the runaway until theaircraft is brought to a halt. It can also control the shutdown of theengines after the aircraft has come to a halt.

A trusted link 130 between the ESP device 106 and the ground station 113can be established. A high level of security is required for thiscommunications link because the data that is transferred over it can beused to directly/indirectly control the aircraft 100. The link may bebased on existing authenticated communications protocols, such as thoseused to communicate with Air Traffic Control, e.g. Controller Pilot DataLink Communications (CPDLC). It will be understood that varioussecurity/safety measures, e.g. encryption, interception prevention,checksums, etc. can be implemented in relation to the trusted link. Itwill also be appreciated that embodiments of this trusted link can beused in non-emergency situations for secure transfer of data.

In some embodiments, the ESP device 106 can generate an emergency routeto an airport for emergency landing of the aircraft 100. In someembodiments, the ESP device may (alternatively or additionally)negotiate with, or receive data relating to a route/airport from, theground station 113. However, the ESP device may be allowed divert theaircraft to its selected airport and land in the absence ofconfirmation/further instructions from the ground station, e.g. due tothe trusted link 130 being lost due to atmospheric conditions, atechnical fault, or other reason.

The routes generated by the ESP device 106 and/or the ground station 113may be restricted to follow officially recognised airways, e.g. onesstored in the navigation system of the aircraft 100, and will alsonormally follow the altitude and speed constraints of the airways. Thisrestricts the ESP device (and/or the ground station) so that arbitraryroutes that could send the aircraft into non-controlled airspace areavoided, thereby reducing the chance of the aircraft leaving controlledairspace. In alternative embodiments, some steps (e.g. establishing thetrusted link and/or calculating a proposed route) of the full activationmode as described herein may be performed (or at least prepared for) inthe initial activation mode. The order of the steps performed in thevarious modes may also vary from the description herein.

FIG. 3 schematically illustrates how embodiments of the ESP device 106can operate/be operated in one of three control modes during the fullactivation mode: ESP full control 302; ESP ground station support 304,or ESP ground station strategic control 306. Modes 304 and 306 usuallyneed to be initiated by the user at the ground station 113. The userwill need to be authenticated and has the authority to change the mode.

In the ESP full control mode 302, the ESP device 106 can calculate a newroute without support from the ground station 113 and canactivate/implement this route itself. However, if the trusted link 130with the ground station 113 becomes, or is, active then mode 304 or 306may be entered. In the full control mode a crew member may regain manualcontrol of the aircraft 100 using a menu system, or the like, of the ESP106. However, if the system is in mode 304 or 306 where the ESP deviceis operating in collaboration with the ground station then the regainingof control by an onboard crew member will be a controlled handover, e.g.similar in methodology to how a pilot transfers controls to the co-pilotor resting pilot.

In the ground station support mode 304, route-planning softwareexecuting on the ground station 113 (and/or a user of the groundstation) can generate a route to be used by the aircraft, includingcontrolling access to waypoints, runways and airways. The generatedroute may be initially based on a route provided to the ground stationby the ESP device 106. The ground station may add a “via” waypoint tocontrol the way a route is flown. It can also demote airways and runwaysin the route generation process by increasing the cost of traveling onthem, as will be described below.

In the ESP Ground Station Strategic Control mode 306, the ground station113 can load a route into the FMS 117 of the aircraft 100 via the ESPdevice 106. The ESP device can then check whether this route isacceptable (within the limitations of the FMS navigation database). Whenthe trusted link 130 is present, the ESP device will not be able tooverride a route that has been loaded from the ground station. However,if the trusted link is lost then the ESP device will start a “link lost”timer. If this timer expires then the ESP device will return to the ESPfull control mode 302. In some embodiments, any route calculated by theESP device will need to be considered to be an improvement over a routeloaded into the FMS by the ground station (e.g. the routes can be scoredand the ESP device-generated route would have to beat the score of theexisting route by a defined percentage or fixed value). This can ensurethat the ESP device will not continually change the route. In someembodiments, the aircraft may also be controlled/flown remotely by auser at the ground station in this control mode.

Examples of the route/destination generation process will be describedbelow. A general aim of the process is to have the aircraft land as soonand as safely as possible, although it will be appreciated thatembodiments of the route/destination generation process may also be usedin non-emergency situations (e.g. for calculating a detour from anoriginally-planned route). Embodiments of the process are typicallyimplemented by software executing on the ESP device 106 and/or theground station 113. In some cases these software components maycommunicate/negotiate with each other in order to generate and/or selecta route/airport. Embodiments typically involve selecting a preferreddestination airport (including a preferred runway in some cases) and apreferred route to reach that airport. Several potentialroutes/destinations may be generated and scores may be assigned to each.The ESP device 106 and/or the ground station 113 can use the scores tomake selections. The scores can take into account various factors,including route distance, safety (e.g. based on altitude constraints),etc. and may be re-calculated due to changes relating to these factors.

The scoring of routes can involve allocating a score to section(s) (e.g.sections between the current/original position of the aircraft and thedestination, taking into account any waypoints) of the route. In someembodiments this score can be promoted to give preference to the routeand/or demoted in order to reduce the likelihood of the route beingselected. Demoting can be done by a multiplier and/or by a fixedaddition/offset. The fixed offset can be set high so the aircraft isvery unlikely to take a particular route. For example, the fixed offsetcould be set to 1024. As the scoring of the routes in some embodimentsis in arc distance, this would mean that to fly this route the routefinder would treat this as flying almost 3 times around the globe. Theground station 113 can close routes and links to runways; however, ahigh score might be better because this means that all routes are stillavailable, but weighted so as to be very undesirable. This means thatthe ground station should never block the ESP device 106 with a brokenroute.

Promotion of a route score can be by a factor of 1. In some embodimentsa route can only be demoted and so routes will always look longer, nevershorter, than the actual route distance. Fuel burn may be estimated andthe system can calculate the Estimated Time of Arrival over all possiblecalculated routes (in some cases using information provided by the FMS).This can be done assuming the wind direction is constant throughout theflight. The system can calculate a simplified true flight speed based onthe cruise speed of the aircraft with no wind and may use a look uptable to apply a factor based on the wind direction with respect to eachairway's azimuth. This will stop the abstracted airway score making theaircraft take a route that is not suitable based on fuel levels. Thecurrent FMS route will be considered possible if it stays on airways(this can be the basis of the initial route generated/provided by theESP device). The skilled person will understand that these operationsare exemplary only and variations are possible, e.g. any type ofindicator(s)/value(s) could be used to indicate the likelihood ofselection of a potential route.

In order to reduce the chance of an impact, where flight level rulesoffer 152 m (500 ft) vertical separation the system would follow theserules. In some cases the ESP device may determine that the aircraftshould fly offering 76 m (250 ft) minimum vertical separation tointerleave. It will be appreciated that these particular values aremerely examples. Other aircraft can be made aware of the ESP controlledaircraft and may increase their own vertical separation.

If flying in oceanic tracks the system may adopt the emergency trackroute, flying with an increased horizontal separation. The aircraft maybe able be able to divert across the tracks or turn around if theseoffered a better solution than continuing in the current direction. Therisk to other aircraft can be assessed and ground station support may berequired to allow the aircraft to cross the tracks. It is typicallyassumed that upon the ESP device 106 entering the full activation mode,the ground station 113 would be ready and responding within, e.g., 15minutes to help guide the aircraft.

Embodiments of the system may ignore some flight restrictions, such astime limits on routes that stop aircraft flying over areas at night.However, generated routes may use demotion to keep the aircraft, wherepossible, flying over non-populated areas.

Embodiments of the ground station 113 can control a double bufferedroute score database. Once route generation is completed, the groundstation can trigger the upload of the generated route to a primedatabase in order to stop incomplete data being uploaded to the ESPdevice 106. Thus, the ground station will not need to wait until allchanges are loaded in order to trigger the upload. This is a precautionin case a single ground station airway update causes a hazard, and a fewloads are required. It can also give the ground station a chance tocheck the data before transfer to the prime database. Forsafety/security, the airway score database can be protected using CRCsor the like.

Approach routes to runways that are suitable, but not preferred, can bedemoted in order to guide the ESP device 106 to land at a preferredrunway, e.g. one at an airport that has good emergency services and longrunways (but not major airports that have demoted approach routes). Theinitial airport that could be selected may be limited to one of more ofthe following: CAT2 ILS or greater; long runways; large but not majorairports; original destination and/or good support services.

Pre-flight, route demotion can restrict runway usage at airports andcontrol approach routes to make the flight path selection asdeterministic as possible. Routes with higher altitude restrictions willbe demoted to reduce their use; in a typical situation the system mayreduce altitude to FL100 (approximately 305 m (1000 ft)) to allowreduced risk of hypoxia. However, this may be limited by restrictions onthe airway. If the airway is restricted (and as unrestricted airways arenot demoted in this manner), the system would be very likely to move toan unrestricted airway and reduce altitude if this is possible.

The ground station 113 can know if ILS systems are not functioning atany airport, and this can affect the ground station's choice of airport.The ESP device 106 can access the ILS tuning function to also sense ifthe ILS is operational. A go around may be completed if no ILS ispresent.

Embodiments may use a weighting system to score airport suitability foremergency landing. Example factors are shown in the table below:

Assessed parameter Comment ESP rating of the airport ESP rating is ascore of the airport for emergency landing Aircraft status Direction andspeed Distance to airport vs possible flight This would include avoidingendurance hazards such as weather and no fly areas If weather needs tobe avoided Weather pattern movement causing more disruption Possibleloss of ground station link If communication could be lost on on flightpath route Weather at airport Good weather: high score Low visibility:reduced score, even though this would not affect the aircraft's flight,it could be related to weather that can affect flight: low score Fit topre calculated ESP flight routes Offline generated preferred ESP flightroutes based on location of the aircraft, and possibly predicted weatherconditions

The system's rating of airports could be performed off line by anassessment team and based on airport data from an A424 database,possibly re-assessed on a periodic, e.g. annual, basis. The criteria forscoring could be based on this and it can also generate a preferredrunway for landing at each airport. Example airport rating factors areshown in the table below:

Assessed parameter Comment Auto land capability If no auto landcapability the scoring would be 0; this would mean if in ESP fullyactive mode a landing would not be possible Auto land category may betaken into account, e.g. cat 1, cat 3 Busyness of airport Length ofrunway Emergency service availably Risk of high winds and changeableweather Local environment Road links, high density urban could scoreless though due to risk of damage/traffic on routes

An estimated airport selection table could be generated offline forregains of flight. This could be assessed by the ESP device on board theaircraft in use.

Embodiments of the route selection may take into account the remainingfuel of the aircraft. If the fuel level allows, the ESP device 106 maycause the aircraft to enter a holding pattern before attempting alanding in order to allow for ground station support before a landing isattempted. If fuel is/becomes low (still allowing for some contingency)and the ground station has not responded then the ESP device may attemptthe landing. Having been in hold allows the ground station to respond,and runways to be cleared, etc. If needed, a Notice To Air Men may bemonitored if the ground station link is not present in order to assistwith determining if runways are clear for landing, possibly using ILS tohelp guide the ESP controlled aircraft.

FIG. 4 is a diagram that schematically illustrates how embodiments ofthe route generator can deal with a runway closure. Embodiments can stopthe ESP device 106 from causing the aircraft 100 to land at lesssuitable runways; constrain the approach route; constrain a go aroundroute, and/or communicate to the ESP device that an airport (e.g.Airport A of the Figure) is not useable at all.

FIG. 5 is a diagram that schematically illustrates how embodiments ofthe route generator can use route demotion polygon routes. Air routescan be represented using 3D coordinates. An adverse weather condition(or other type of obstacle or hazard) can also be represented using 3Dcoordinates. The skilled person will be familiar with the use of 3Dpolygons for modelling avionic weather maps and mapping ofcontrolled/restricted airspace. The likelihood of selection of routescan be affected by scores assigned to coordinates of the polygon, e.g. aworse score can represent bad weather. The ground station 113 can affectroute scores by affecting the multiplier or fixed offset based onoverlap of coordinates of a route and the 3D polygon. The ground stationwill not be able to reduce the score multiplier below a value given bythe polygon. The polygon only changes the multiplier by the amount thepolygon covers of the section of the route. For example, for a routedistance of 10, if the polygon has a score of 2 and covers 9.26 km (5nm) then the effective score with a linear cover factor would be 15. Theground station can add a fixed offset to make a route very unattractiveto the ESP device 106. The fixed offset may also be affected by altitudeconstraints for the link/route section. The ground station will not beable to adjust this below that given by the altitude constraint factor.

At least some embodiments of the invention may be constructed, partiallyor wholly, using dedicated special-purpose hardware. Terms such as‘component’, ‘module’ or ‘unit’ used herein may include, but are notlimited to, a hardware device, such as a Field Programmable Gate Array(FPGA) or Application Specific Integrated Circuit (ASIC), which performscertain tasks. Alternatively, elements of the invention may beconfigured to reside on an addressable storage medium and be configuredto execute on one or more processors. Thus, functional elements of theinvention may in some embodiments include, by way of example,components, such as software components, object-oriented softwarecomponents, class components and task components, processes, functions,attributes, procedures, subroutines, segments of program code, drivers,firmware, microcode, circuitry, data, databases, data structures,tables, arrays, and variables. Further, although the example embodimentshave been described with reference to the components, modules and unitsdiscussed below, such functional elements may be combined into fewerelements or separated into additional elements.

Attention is directed to any papers and documents which are filedconcurrently with or previous to this specification in connection withthis application and which are open to public inspection with thisspecification, and the contents of all such papers and documents areincorporated herein by reference.

All of the features disclosed in this specification (including anyaccompanying claims, abstract and drawings), and/or all of the steps ofany method or process so disclosed, may be combined in any combination,except combinations where at least some of such features and/or stepsare mutually exclusive.

Each feature disclosed in this specification (including any accompanyingclaims, abstract and drawings) may be replaced by alternative featuresserving the same, equivalent or similar purpose, unless expressly statedotherwise. Thus, unless expressly stated otherwise, each featuredisclosed is one example only of a generic series of equivalent orsimilar features.

The invention is not restricted to the details of the foregoingembodiment(s). The invention extends to any novel one, or any novelcombination, of the features disclosed in this specification (includingany accompanying claims, abstract and drawings), or to any novel one, orany novel combination, of the steps of any method or process sodisclosed.

The invention claimed is:
 1. An aircraft emergency control system, thesystem comprising: at least one sensor configured to output anelectronic signal relating to detection of incapacitation of at leastone aircraft crew member; a processor configured to receive and processthe electronic signal to determine whether an emergency action is to betaken and to generate a plurality of emergency routes for flying theaircraft to an emergency landing destination; and a control unitconfigured to communicate, in use, a control signal to an avionicssystem of the aircraft in relation to the emergency action if theprocessor determines that the emergency action is to be taken, whereinone of emergency routes is selected in response to taking the emergencyaction based on a score assigned to each of a plurality of sections ofeach of the emergency routes.
 2. The system according to claim 1,wherein the at least one sensor comprises an imaging device, and theprocessor is configured to analyse images encoded in the electronicsignals of the imaging device in order to detect movement of the atleast one crew member, and determine that the emergency action is to betaken if no said movement is detected during a predetermined period oftime.
 3. The system according to claim 1, wherein the at least onesensor comprises an audio device, and the processor is configured toanalyse audio data encoded in the electronic signals of the audiodevice, and determine that the emergency action is to be taken if nosaid audio data indicating speech and/or movement of the at least onecrew member is detected during a predetermined period of time.
 4. Thesystem according to claim 1, wherein the at least one sensor isconfigured to provide an electronic signal representing operation of atleast one controller of the aircraft by the at least one crew member,and the processor is configured to determine that the emergency actionis to be taken if the electronic signal representing operation of the atleast one controller of the aircraft indicates that the at least onecontroller has not been operated during a predetermined period of time.5. The system according to claim 1, wherein the system is configured to,in use, transfer data relating to the selected emergency route to aFlight Management System of the aircraft and uses an auto-pilot systemof the aircraft to implement the selected emergency route.
 6. The systemaccording to claim 1, wherein the system further comprises acommunications interface configured, in use, to establish anauthenticated communications link with a remote station, and transfersdata relating to the selected emergency route onto the remote station.7. The system according to claim 6, wherein the system is operable in: afirst mode wherein the system is configured to generate or modify theselected emergency route without support from the remote station and tocontrol the aircraft to implement the selected emergency route, and/orthe system is able to allow an authenticated onboard crew member toregain manual control of the aircraft from the system, or a second modewherein input from the remote station is required for generation ormodification of the selected emergency route and to allow the system toimplement the selected emergency route, and/or input from the remotestation is required to allow an authenticated onboard crew member toregain manual control of the aircraft from the system.
 8. The systemaccording to claim 6, wherein if the authenticated communications linkbetween the system and the remote station is active in use then thesystem is disabled from modifying the selected emergency route, and ifthe authenticated communications link between the system and the remotestation is lost in use then the system is enabled to modify the selectedemergency route.
 9. The system according to claim 1, wherein the systemis configured to generate the plurality of emergency routes by:assigning the scores to each of the plurality of potential emergencyroutes; and selecting one of the plurality of emergency routes forimplementation based on the assigned scores; wherein assigning thescores to each of the plurality of emergency routes includes applying ademotion and/or a promotion factor to each section of the emergencyroutes based on at least one factor, wherein the at least one factorincludes distance, flying altitude constraints, weather conditions,suitability in terms of aircraft fuel levels, collision risk,destination features, and/or destination runway features.
 10. Anaircraft including a system according to claim
 1. 11. Acomputer-implemented method of aircraft emergency control, the methodcomprising: receiving an electronic signal relating to detection ofincapacitation of at least one aircraft crew member; processing theelectronic signal to determine whether an emergency action is to betaken and to generate a plurality of emergency routes for flying theaircraft to an emergency landing destination; and if the processingdetermines that the emergency action is to be taken then communicating,in use, a control signal to an avionics system of the aircraft inrelation to the emergency action, wherein one of emergency routes isselected in response to taking the emergency action based on a scoreassigned to each of a plurality of sections of each of the emergencyroutes.
 12. The method according to claim 11, wherein if the processingdetermines that emergency action is to be taken then the method furthercomprises starting a timer for receiving a user input relating toprevention of the sending of the control signal to the avionics system.13. The method according to claim 11, comprising disabling manualcontrol of the aircraft while the at least one crew member is determinedto be incapacitated.
 14. A computer program product including one ormore non-transitory computer-readable storage mediums includinginstructions that, when executed by one or more processors, cause aprocess to be carried out for aircraft emergency control, the processcomprising: receiving an electronic signal relating to detection ofincapacitation of at least one aircraft crew member; processing theelectronic signal to determine whether an emergency action is to betaken and to generate a plurality of emergency routes for flying theaircraft to an emergency landing destination; and if the processingdetermines that the emergency action is to be taken then communicating,in use, a control signal to an avionics system of the aircraft inrelation to the emergency action, wherein one of emergency routes isselected in response to taking the emergency action based on a scoreassigned to each of a plurality of sections of each of the emergencyroutes.
 15. The computer program product according to claim 14, whereinif the processing determines that emergency action is to be taken thenthe process further comprises starting a timer for receiving a userinput relating to prevention of the sending of the control signal to theavionics system.
 16. The computer program product according to claim 14,the process further comprising disabling manual control of the aircraftwhile the at least one crew member is determined to be incapacitated.17. The computer program product according to claim 14, the processfurther comprising at least one of: analysing image and/or audio data todetect speech and/or movement of the at least one crew member;determining that the emergency action is to be taken if no said speechand/or movement is detected during a predetermined period of time; anddetermining that the emergency action is to be taken if an expectedelectronic signal has not been received during a predetermined period oftime.
 18. The computer program product according to claim 14, theprocess further comprising engaging an auto-pilot system of the aircraftto implement the selected emergency route.
 19. The system according toclaim 1, wherein the selected emergency route has a highest scoreassigned to each of a plurality of sections of each of the emergencyroutes.
 20. The system according to claim 1, wherein at least one scoreis a function of a multiplier and/or fixed offset value based on overlapof coordinates of at least one section of the selected emergency routeand coordinates of a 3D polygon.